Certified Identity and Access Management Designer

Here you have the best Salesforce Certified Identity and Access Management Designer practice exam questions

You have 60 total questions to study from
Each page has 5 questions, making a total of 12 pages
You can navigate through the pages using the buttons at the bottom
This questions were last updated on October 9, 2025
This site is not affiliated with or endorsed by Salesforce.

Question 1 of 60

Universal Containers (UC) has decided to build a new, highly sensitive application on the Lightning platform. The security team at UC has decided that they want users to provide a fingerprint in addition to username/password to authenticate to this application.
How can an Architect support fingerprints as a form of identification for Salesforce authentication?

Use Custom Login Flows with callouts to a third-party fingerprint scanning application.

Use Salesforce Two-factor Authentication with callouts to a third-party fingerprint scanning application.

Use Delegated Authentication with callouts to a third-party fingerprint scanning application.

Use an AppExchange product that does fingerprint scanning with native Salesforce Identity Confirmation.

Correct Answer: A

The best way to support fingerprints as a form of identification for Salesforce authentication is to use Custom Login Flows with callouts to a third-party fingerprint scanning application. Custom login flows allow for more flexibility in integrating third-party authentication mechanisms, such as fingerprint scanning, into the Salesforce authentication process. This method enables the application to obtain the username and password first, and then trigger a callout to the third-party service to perform the fingerprint scan as an additional layer of security.

Question 2 of 60

Universal Containers (UC) is successfully using Delegated Authentication for their Salesforce users. The service supporting Delegated Authentication is written in Java. UC has a new CIO that is requiring all company web services be REST-ful and written in .Net.
Which two considerations should the UC Architect provide to the new CIO? (Choose two.)

Delegated Authentication will continue to work with REST services.

Delegated Authentication will continue to work with a .Net service.

Delegated Authentication will not work with REST services.

Delegated Authentication will not work with a .Net service.

Correct Answer: A, B

Delegated Authentication in Salesforce requires web services that can interact with Salesforce systems. These services can be either SOAP-based or RESTful. Thus, a RESTful service written in .Net can be used for Delegated Authentication, making it compatible. Therefore, Delegated Authentication will continue to work both with REST services and a .Net service.

Question 3 of 60

How should an Architect force users to authenticate with Two-factor Authentication (2FA) for Salesforce only when NOT connected to an internal company network?

Apply the “Two-factor Authentication for User Interface Logins” permission and Login IP Ranges for all Profiles.

Add the company's list of network IP addresses to the Login Range list under 2FA Setup.

Use Custom Login Flows with Apex to detect the user's IP address and prompt for 2FA if needed.

Use an Apex Trigger on the UserLogin object to detect the user's IP address and prompt for 2FA if needed.

Correct Answer: C

Question 4 of 60

What is a role of an Identity Provider in a Single Sign-on setup using SAML?

Consume assertion

Revoke assertion

Validate assertion

Create assertion

Correct Answer: D

Question 5 of 60

Universal Containers (UC) is setting up delegated authentication to allow employees to log in using their corporate credentials. UC's security team is concerned about the risks of exposing the corporate login service on the internet and has asked that a reliable trust mechanism be put in place between the login service and Salesforce.
What mechanism should an Architect put in place to enable a trusted connection between the login service and Salesforce?

Require the use of Salesforce security tokens on passwords.

Enforce mutual authentication between systems using SSL.

Set up a proxy service for the login service in the DMZ.

Include Client Id and Client Secret in the login header callout.

Correct Answer: B, C

To ensure a trusted connection between the login service and Salesforce, mutual authentication using SSL should be enforced. This ensures both parties verify each other's identity before establishing a connection, preventing unauthorized access and ensuring data integrity. Additionally, setting up a proxy service for the login service in the DMZ (Demilitarized Zone) adds an extra layer of security by isolating the internal network from direct exposure to the internet, which addresses the security team's concern regarding the risks of exposing the corporate login service.